SIM Card Registration
SIM card registration is the process of recording the details of the person who owns a SIM card. This might occur through using an official ID, passport, or proof of address; in some countries, biometrics are also collected. Usually, the details are held by the state, even if a telecommunications company collects the information. It allows the state to know the identity of the owner of a SIM card, and thus who is most likely making a call or sending a message.
Governments require telecommunications companies to store communications or metadata for a period of time, a practice called data retention. Increasingly, financial services such as insurers, lenders, banks, and financial mobile app startups, are collecting and exploiting a broad breadth of data to make decisions about people, including reading the contents of text messages to determine suitability for a loan. Mobile money transfer services use SMS to transmit details of transactions.
Especially in the absence of comprehensive data protection legislation and judicial oversight, SIM users' information can be shared and matched with other private and public databases, enabling the state to create comprehensive profiles of individual citizens, and enabling companies and third parties to access a vast amount of data. This is yet another way for government and industry to build identity systems to support their needs to administer, govern, and profit. In turn, they are being used to facilitate targeting, profiling and surveillance. It is essential to limit the purposes for which an identity system is built and used.
What Is The Problem
Mandatory SIM card registration eradicates the potential for anonymity of communications, enables location-tracking, and simplifies communications surveillance and interception. It can also be used in conjunction with an IMSI catcher to know the possible identities of everyone in a particular area. This makes it possible for security agencies to listen and view past communications.
Not only does SIM card registration undermine the right to privacy and pose a threat to vulnerable groups, it has also been exposed as ineffective and inefficient in some countries that have adopted its use. The common justification is that it will assist in reducing the abuse of telecommunications services for criminal and fraudulent activity. But it has not been effective in curbing crime, and instead has fueled it: states which have adopted SIM card registration have seen growing identity-related crime, and black markets quickly popping up to service those wishing to remain anonymous. Moreover, SIM cards can be illicitly cloned, and criminals can use foreign SIMs on roaming mode, or through internet and satellite telephones, to circumvent SIM registration requirements.
As many developing countries have or are planning to introduce compulsory SIM registration, governments would have phone numbers, tracking data, and subscriber information (including address and family name). In countries with political and ethnic tensions, pairing this data with political activity might result in physical risks for the people involved.
Here are some of the risks that SIM card registration can bring:
- Tracking: By facilitating the creation of an extensive database of user information, individuals are at risk of being tracked or targeted, and having their private information misused. In the absence of comprehensive data protection legislation and judicial oversight, SIM users' information can be shared and matched with other private and public databases, enabling the state to create comprehensive profiles of individual citizens.
- Profiling: An individual's phone number could potentially be matched with their voting preferences or health data, enabling governments to identify and target political opponents, for example, or people living with HIV/AIDs. The potential for misuse of such information, particularly in countries with traditions of ethnic conflict and political instability, is enormous.
- Exclusion: In some countries, SIM card registration can also have other discriminatory effects as the poorest individuals are often unable to buy or register SIM cards because they don't have identification documents. Undocumented migrants can face a similar problem. When mobile phones are the most common form of accessing important avenues such as banking and finance, this could result in exclusion from numerous vital public services. Moreover, given the extra burdens that SIM registration places on telcos, this may result in additional costs being passed on to customers.
- Discrimination: Mandatory SIM card registration also tends to discourage or discriminate against categories of people. Requiring people to personally appear and present identification documents in order to purchase a SIM card will prove tricky for those with limited mobility, those that live in remote places, and those who simply do not have basic documentation. They may be forced to forego registration — and their ability to communicate — altogether.
What Is The Solution
Any requirements for mandatory SIM card registration limit the individual’s right to privacy and anonymity in exercising free expression. As noted by the UN Special Rapporteur on Freedom of Expression, David Kaye, “compulsory SIM card registration may provide Governments with the capacity to monitor individuals and journalists well beyond any legitimate government interest”.
We support his recommendation that states should refrain from making the identification of users a condition for access to digital communications and online services, and requiring SIM card registration for mobile users. We believe that the possible negative consequences of implementing a measure of this nature far outweigh its proposed advantages. SIM cards are really not suited for being an ID card, and telecommunications companies are not suited to running ID systems.
We also advise governments to:
- Establish regulatory frameworks that have clearly defined and limited mandates for retention of communications data, and order judicial oversight in their individual request and delivery.
- Limit the collection and use of personal data for the implementation of public policies and the provision of public services to data that is necessary and proportional to the legitimate purpose pursued, by conducting a human rights impact assessment, and ensuring transparent participatory processes prior its implementation.
- Introduce safeguards to ensure that the rights of mobile telephone subscribers in relation to their personal data are guaranteed.
- If not in place, adopt and enforce a comprehensive data protection law to ensure the protection of the personal data of its citizens.
What PI Is Doing
Closely tied with our work on data retention and identity, PI is working with partners in our International Network and experts, to undertake research and advocacy work in this area:
- We raise awareness about the risk of SIM card registration.
- We articulate a set of safeguards and oversight measures that are consistent with international human rights standards to policy makers.
- We advocate for better safeguards at the national, regional, and international level.